What Is A Data Breach?

A data breach is an event that results in confidential, private, protected, or sensitive information being exposed to a person not authorized to access it.

It can be the consequence of an accidental event or intentional action to steal information from an individual or organization. For example, an employee could accidentally expose sensitive information or they could purposely steal company data and share it with—or sell it to—a third party. Alternatively, a hacker might steal information from a corporate database that contains sensitive information.

Whatever the root cause of a data breach, the stolen information can help cyber criminals make a profit by selling the data or using it as part of a wider attack. A data breach typically includes the loss or theft of information such as bank account details, credit card numbers, personal health data, and login credentials for email accounts and social networking sites.

An information breach can have highly damaging effects on businesses, not only through financial losses but also the reputation damage it causes with customers, clients, and employees. On top of that, organizations may also be subjected to fines and legal implications from increasingly stringent data and privacy regulations like the European Union’s General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

Protecting customer information is a vital business practice and fundamental cybersecurity priority.

A data breach can be caused by an outside attacker, who targets an organization or several organizations for specific types of data, or by people within an organization. Hackers select specific individuals with targeted cyberattacks. 

Data breaches can be the result of a deliberate attack, an unintentional error or oversight by an employee, or flaws and vulnerabilities in an organization’s infrastructure.

Learn more about Data Integrity. 

A common form of security incident is the loss of devices or unauthorized access to credentials, resulting in cyber criminals obtaining confidential information. For example, a lost laptop, mobile phone, or external hard drive that is unlocked or unencrypted can easily lead to information being stolen if it ends up in the wrong hands. Even a locked device could be hacked into by a sophisticated attacker.

An insider attack is a data breach caused by an employee leaking information to a third party. Also known as a malicious insider, this individual will access or steal data with the intent of causing harm to the organization or another individual within the company. 

For example, the malicious insider could have access to the company’s financial details or a client list, which they could pass on or sell to a competitor. Alternatively, the malicious insider could access information about high-risk individuals within the organization—or even password details—and sell them to a hacker for a profit.

Targeted data breach attacks see a cyber criminal or a group of attackers target specific individuals or organizations to obtain confidential information. Attackers use various methods to gain unauthorized access to corporate networks and systems or to steal user login credentials. Common types of targeted cyberattacks that can result in a data breach include:

1. Phishing attack: A phishing attack involves cyber criminals using social engineering to steal information like credit card details, login credentials, and user data. Attacks typically masquerade as an email or Short Message Service (SMS) from a trusted individual to dupe the victim into opening a malicious link or visiting a spoofed website.
2. Malware attack: A malware attack occurs when an attacker tricks a target into opening a malicious attachment, link, or website. The attacker will then inject malware onto the user’s device to steal their credentials. 
3. Vulnerability exploits: Cyber criminals routinely search for potential vulnerabilities in organizations’ hardware or software before the vulnerability becomes known to the company. This form of attack, known as a zero-day attack, occurs when a hacker creates an exploit then launches it before the organization is able to patch the vulnerability.
4. Denial-of-service (DoS) attack: A DoS attack is an intentional attack that aims to overload an organization’s network or website with fake requests. This will prevent legitimate users from gaining access, crashing the system, or damaging it. Attackers can also use multiple infected machines, known as a botnet, to launch distributed denial-of-service (DDoS) attacks.